Why thinking in the shower may be an ideal model for "creative pause" - <AUTHOR> http://cameronmoll.com/archives/2008/11/showering_and_thinking/ <comment><USER2> I have most of my best ideas in the shower. I first noticed it when I was doing my own nanowrimo ripoff (cowoh.org) in 2002ish and I'd have my good plot twists while I was sorting out the shampoo.

Unfortunately, it's one of those things you can't talk about because the moment you do it some smart ass will make a rude remark about the sorts of ideas you might have in the shower, and that kills of the momentum of the interesting thing you were about to leap into describing. It is a reliably frustrating opener. The first comment to that post is a case in point.

Another place I have great ideas is in the kitchen when I'm doing the dishes. This goes back to a period where I had a horrible job and the only satisfaction I used to get in a day was coming home and washing my families dishes. I'd go so far as to say that my claim on those dishes, twice a day, was what got me through that hellish, soul-destroying period and subsequent breakdown.

So now I tell people that I had a great idea while I was doing the dishes, even though odds are that it was in the shower. It's just easier that way.

Good writeup. I think the benefit of a creative pause is that it makes you reload which makes you requestion some assumptions. Reloading can be expensive though.

</comment><comment><USER3> I wonder if this will get more hackers to shower regularly...

</comment><comment><USER4> I find thinking on the bus works best for me. I now actively don't carry any books with me there. The combination of listening to some music I like and retreating into my own mental bubble brings up all sorts of interesting ideas. Instead of books, I now carry a notepad.

</comment><comment><USER5> * Distractions are minimized, including noise

* The body is engaged in a monotonous, mundane, or repetitive activity, freeing the mind to think about other things

* The environment is changed

Another activity that fits these requirements is running. It also has the added benefit of physical exercise.

<comment><USER6> Bicycling works better for me--smoother, less painful. The tricky part is pulling out a notepad and writing something down while dodging cars and jumping curbs.

<comment><USER7> Anyone need some iPhone appdev inspiration?

You know the iPhone headphones, the ones that have a little microphone built into the side? It acts as a button, as well (I'm not sure if it's a soft button, though.)

I imagine that, if it _were_ a soft button, someone could write, quite simply, a voice recorder program whose recording was toggled by that button. You could leave music running in the background, with the recorder running in the foreground, then press the button (both temporarily pausing the music at starting the recording), dictate your thought, and press the button again, at which point the music would resume.

</comment></comment></comment><comment><USER8> I generally take long showers (sometimes 45mins+), and this is exactly why. I just stand there in the water and think. Some people think it's weird, but there's no better time to design software or work over a problem you're having.

<comment><USER9> Same here! My mom always used to get on my case about it too.. I just hope karma doesn't kick my ass for wasting all that water.

</comment></comment><comment><USER10> I have a bath every day about 2pm for this very purpose :/ As strange as that sounds.

<comment><USER11> bubbles?

<comment><USER10> Usually a book, sometimes my macbook perched on the toilet showing a DVD. Quite often an ice lolly.

Too much info?

Actually that reminds me of a funny time - I was reading a book in the bath, while eating a "mars ice cream" - chocolate covered ice cream. Took a bite, and the thing cracked all over the place, fell in the bath. Melted chocolate everywhere. My wife happened to come up, peer in the bathroom.....

"It's _not_ what it looks like honey.... :-/"

<comment><USER12> _Way_ too much information! ;-)

</comment></comment></comment></comment><comment><USER12> When I'm working on something difficult, I stay at home, and often average 3 or 4 showers a day.

<comment><USER10> This is why you should live in the UK! Just stand outside in the rain ;)

</comment></comment><comment><USER13> Descartes did a lot of his thinking in bed.

<http://en.wikipedia.org/wiki/Descartes>

</comment><comment><USER14> Once try too hard to have a creative pause deliberately with what ever magic/shower formula you came upon it will evaporate. In the wise words of olbermann "Good night and good luck"

</comment><comment><USER15> One of my friends (maybe he'll reply to this) gave his high school class president graduation speech about how he does his best thinking on the toilet.

<comment><USER16> Sure did, though I'm not sure if that's the case anymore -- I have this great chair now...

</comment></comment><comment><USER17> 1\. Start a company 2\. Shower 3\. Profit!

<comment><USER9> Step 3 should read ???

</comment></comment><comment><USER18> How true this is... I love how my girlfriends' never get it... they think I'm just 'doddling.' Little do they know that if I had enough time (and a big enough hot water heater)... I'm sure my thinking in the shower would facilitate my destiny to conquer the world.

<comment><USER19> Then I, for one, welcome our new wrinkly-pink overlords.

Shower ideas are great, but taking long showers to get ideas is criminally wasteful. Try this instead: go into the bedroom, make it really dark, light a candle or something and play one of those 'pink noise' tracks: rainforest, ocean, etc. Or take a walk.

<comment><USER7> If you're not actually _cleaning_ yourself--that is to say, if you're already clean, not if you're lazy--then there's no reason to be using any more clean water. There could be set up a switch that, when flipped, moved from a "use/dispose" model to a "use/recycle" (under the literal meaning of the term "re-cycle") one. It would, of course, build a small buffer at the beginning so it wouldn't just be spraying the last of your shampoo all over you, but that would be the last of the new usage for the day, and it could last as long as you want--only as dirty as a bath, but in motion!

<comment><USER20> why? the faster we waste resources the more motivated we'll be to come up with new solutions. necessity is the mother of invention.

</comment></comment></comment></comment><comment><USER21> Using psilocybin responsibly once every few months would be a more ideal mode for a creative pause.

The stupid fearful superstitious monkeys who run the stupid government don't want people at an ideal level of creativity and optimism, so you can't legally access the best way to have a creative pause. So, we get the result of people who know how to best foster creativity and optimism being outlaws, and people who study psychology for a living produce bullshit work like this. This kind of thing is aimed at turning you from an uncreative monkey to a slightly less uncreative monkey.

Why not wake up from your programmed modes of thinking and be a free human being instead? I guarantee you, give me 10 people and I could safely induce a better 'creative pause' with a 2 day camping trip where mushrooms were used safely, then this guy could with 100 showers.

We're at a place in human history where we are either going to get serious about fixing the problems on spaceship earth, or we're going to destroy it. Fixing the problems requires huge amounts of optimism and creativity. We don't have time for people (especially entrepreneurs) to be thinking a shower is the best way to safely enhance creativity. We can solve the problems that might destroy our planet if we safely use what the outlaws know in the right way. We can't if we're all taking showers thinking that will be what makes us creative.</comment>


Workaholism in America: A European's perspective - <AUTHOR> http://www.huffingtonpost.com/tijana-milosevic/workaholism-america-europe_b_805975.html

<comment><USER2> _American parents are not perceived to provide enough financial and emotional support for their children_

This reality is unfortunately very true in the US. My mother used to joke about the fact that our 18th birthday would consist of a moving trucks as a present. While it was a tongue in cheek joke there was without a doubt a grain of truth to her attitude. Fortunately for me, my grandparents took me in long before that. They came from a different culture than my mother. I am from the US south and the old southerners have a distinctly different culture than that of the rest of the us. There was a lot more French and Spanish influence in the south and up until my grandparents generation that culture was the norm. Anyways, not to side track too much into the distinct cultures of the US or the loss of those cultures, but my point is my grandparents came from a culture in which it was normal for a child to live and help around the home until the time that they where on stable footing to go out into the world. Usually there was a gift of land or some other property that would help the child start to make their way in the world. All of my grandfathers siblings got a portion of the homestead when they became of age from my Great- Grandfather. That was pretty much the norm in the American south up until around the 1940's. While I did not receive a gift of land, I did receive the gift of time. My grandparents allowed me to live with them and supported me while I pursued ventures to that would help me make it in the world. On the final venture they purchased a computer for me and the rest was history. Had I been forced out at 18 who knows where I would have ended up I certainly know that I would not enjoy the quality of life I do know. For that I am eternally grateful to them. I plan to do the same for my children, I always talk to them about ways to make money and be your own boss. Better yet I serve as an example to them. I plan to make sure that before any one of my kids leaves home that they have a functional and profitable venture to call their own. That is the greatest gift you can ever give to your children, the gift of time to discover one's self.

The thing to remember is that not only is their a cultural element to this but there is also an economic element to this. I have read several studies that state while the American quality of life measured on the indicators of food availability and health care has significantly improved, the real wealth of the average US citizen has declined. So some of this cultural element seems to be born out of necessity.</comment>


Reconsidering Résumés: Advice from a Manager - <AUTHOR> http://www.subversivecopyeditor.com/blog/2010/09/getting-a-job.html

<comment><USER2> All of her criticisms are spot-on, but the post is pretty useless without offering contrapuntal advice.</comment>


Google Contacts - <AUTHOR> http://www.google.com/contacts <comment><USER2> What's the significance of this?</comment>


R4ndom's Beginning Reverse Engineering Tutorials - <AUTHOR> http://thelegendofrandom.com/blog/sample-page <comment><USER2> Don't forget +ORC and +Fravia, both legends for their notable tutorials, if a little aged.

Admittedly I didn't learn from any tutorials myself. Pick up a debugger, find a mission (say, a trainer or a crack), learn assembly language and go for it worked for me! I did get schooled a bit by Katja who once sent me a .TOS with a symbol table that exploited my debugger, however - I didn't see that one coming! (They don't make 'em quite like that anymore.)

Knowing, especially these days, how compilers mangle what goes in to what comes out helps: it's not always obvious to human eyes.

If you're wishing to learn what's most hard to teach, it's more of a thought process - +ORC called it seeking. Seeking meaning behind what you see; not just reversing the code you read, but divining the higher-level intent behind it. I suppose experience gives you that, but you can still be thrown a few curveballs even when you've seen everything.

I always had a soft spot for rep movsb.

</comment><comment><USER3> This is very awesome! Thanks for putting this out there. This reminds me a lot of Lena's reversing for newbies tutorials. I'm going to go into this more in depth when I get home.

</comment><comment><USER4> As someone interested in learning more about Security/Reverse Engineering, anyone have any feedback on this?

<comment><USER5> Random's tutorials are very good, though at the moment I'm making more headway with Lena's (linked above on tuts4you). This is probably because I'm still new to assembly language and Olly/idb.

The canonical intro book I recommend is Practical Malware Analysis (No Starch), with their debugging and IDA books as supplements :) [http://www.nostarch.com/malware](http://www.nostarch.com/malware)

</comment></comment><comment><USER6> Another bunch of video tutorials that are very popular with reversing newbies: [https://tuts4you.com/download.php?list.17](https://tuts4you.com/download.php?list.17)</comment>


Show HN: Iconfu  – Customizable icons with your color and style as SVG and font - <AUTHOR> https://www.iconfu.com/ <comment><AUTHOR> Jan here, one of the main programmers and designers of Iconfu. If you have any questions, just ask.</comment>


Industrial IoT will be built on Linux Arduino boards - <AUTHOR> http://www.electronicsweekly.com/blogs/distribution-world/industrial-iot-will-be-built-on-linux-arduino-boards-2016-05/ <comment><USER2> You might be right. Arduino offers real-time capability where as raspberry pi does not. Adding Linux to Arduino may take away that real-time capability.</comment>


The Economics of Anime - <AUTHOR> http://www.animenewsnetwork.com/feature/2012-03-05 <comment><USER2> A corollary to this is that resources are eventually going to get diverted to produce the kinds of things which appeal to hyperconsuming outliers who actually spend money on anime rather than e.g. a broader demographic which prefers to steal their anime. That is a large portion of the reason why the Akihabara crowd gets what they want in Japan -- they actually plunk down $X00 for a boxed set of Young Geek Improbably Surrounded By Beautiful Women Who Suffer Wardrobe Malfunctions Around Him with some degree of regularity, though that market appears to be drying up in recent years. (For obvious reasons I don't follow it, I just hear things on the IP grapevine.)

More mainstream audiences can't get things done for them without e.g. a cross- subsidy from Nintendo who can afford to treat the anime as a loss leader for the video game or collectible tie-in.

This is a shame for folks who care about distributional access, by the way. For example, there exist people who think that shoujo manga is a Good Thing (TM) for the U.S. comic books industry because it provides young girls with stories they can relate to and helps counteract the insanely rampant hypersexualization and misogyny of the US comic industry. Unfortunately, shoujo manga has fairly few crossover hits and hasn't had a commercialization success in the US comparable to e.g. Disney's line of princess products, which means that the industry is largely a) not willing to devote marketing muscle to promoting it as much as Bleach / Naruto / Pokemon / etc and b) some would argue that the old guard justify their marginalization of the genre and its fans by saying that (because of their marginalization!) it failed to sell well.

n.b. I'm neither a fan of shoujo manga nor a great lover of women's studies but someone who was both had veto power on my degree, so you can bet I at least listened for the more credible claims.

<comment><USER3> I think that a lot of westerners fail to realize the impact of the "otaku as superconsumer" effect on the Japanese media industry, in part due to the way that anime is priced in western territories. In Japan, anime blu-ray volumes are tremendously expensive; right now the latest volume of Madoka is selling for over ¥9,000 (>$100), and that's a fairly typical price for a single volume containing three 25-minute episodes. In the west, $300-400 will get you several hundred 45-minute episodes of Deep Space 9 on DVD. In Japan, $300-400 is the amount that a hardcore fan can be expected to spend on the blu-rays for a dozen 25-minute episodes. On top of this, there is merchandising galore; CDs for OP/ED, insert songs, character CDs, along with physical goods like figures.

On top of this, sometimes hardcore fans will buy _multiple_ copies of their favorites to inflate sales numbers. For an extreme example, see this man who bought 5500 copies of a single AKB48 CD: <http://blog.esuteru.com/archives/3347822.html>

To put things into perspective, the Bakemonogatari blu-rays sold around 50,000 copies per volume during the release window, which catapulted it to the status of "most commercially-successful anime since Evangelion." Based on this, it's not hard to see how a base of several thousand really dedicated fans could be enough to justify an anime production.

<comment><USER4> I've seen the inside of a typical Tokyo apartment, I gotta ask, honestly, where do they keep all this stuff?

<comment><USER5> The inside of an otaku's apartment is anything but typical: [http://www.google.co.jp/search?q=%E3%82%AA%E3%82%BF%E3%82%AF...](http://www.google.co.jp/search?q=%E3%82%AA%E3%82%BF%E3%82%AF%E3%81%AE%E9%83%A8%E5%B1%8B&hl=ja&tbm=isch)

Here's a nice example: [http://www.wolfheinrich.com/wp- content/uploads/2009/02/dsc00...](http://www.wolfheinrich.com/wp- content/uploads/2009/02/dsc00307.jpg)

</comment></comment></comment></comment><comment><USER6> I went to our regional Anime/Manga conference with my kids last month.

One of the more interesting panel discussions was with an American voice actress. The economics for such a profession are discouraging of course, and she couldn't hold back the opinion that watching anime from the net was "stealing".

But you look around the audience and clearly the great majority of the fans are too young to have real jobs. Still, many of these young people have put untold hours of work into making these incredible costumes.

Then you go to the vendors (or anywhere) to look at a licensed DVD for a season or two of a popular anime: $60 !

1\. It's outrageously priced.

And the hardcore fans don't even like the product as much as the "fan subs" available online. E.g.:

2\. It's usually overdubbed instead of subtitled.

3\. Often it's edited down for more commercial slots for US cable TV.

4\. Where there are subtitles for the opening and ending songs they don't have phonetic Japanese (romaji) or karaoke effects (words exploding into pink flowers are hugely important to a certain set of customers).

5\. The translation is often not accurate, all the Japanese idiosyncracies are ironed out to make completely bland English. (Was said to be usually at the insistence of the Japanese studio).

EDIT: Of course I forgot the most important parts:

6\. The video quality of the fansubs is often much better at 720p.

7\. The fansubs are often more available, sometimes within hours of something appearing on TV in .jp. Official DVDs may drag out for years of on-again off- again rumors.

8\. The fansubs of course have no DRM. They're just files that play on your computer and can be shared among fans. (Though sometimes they require codec downloads from sketchy looking sites).

<comment><USER7> The way I've had it explained to me is that the pricing is high because the Japanese market will bear it, and so lowering the prices on the Japanese market would hurt profits. When they've experimented with selling U.S. DVDs cheaper, Japanese fans have imported them at the lower price, killing sales of the more profitable Japanese region version. One way they've attempted to mitigate this is to make the DVDs unattractive to Japanese buyers using the methods you describe such as having dubbed audio with no Japanese sound option, or delaying the release.

edit: the japanese market's willingness to pay high media prices is explained on page 2 of the article

<comment><USER8> This is part of a general pattern where producers actively choose the level of piracy that maximises their profits, then complain about it in the hope of further increasing profits via politics and social engineering.

</comment></comment></comment><comment><AUTHOR> I submitted this story because there's been a great deal of talk from tech companies on how to disrupt Hollywood — and I think while anime is a niche (my favorite niche!) that this article gives a very good insight into just how hard that might be to pull off. It a very expensive and high risk market to play in — and this article gives the numbers to back it up...

<comment><USER9> :D I already have some ideas for this, especially with the current state of the anime industry and subbing. Bandai Namco closing their U.S. Distribution for anime was an additional amplifier for a need to disrupt it.

The main issue is licensing, and showing the "old guard" the new ways to capitalize on the market instead of relying on the current traditions.

Also wanted to add the "current traditions" are similar to the music and movie industry. More so in the vein of music, with the evolution of how fans can acquire anime. So they see no real need to pay for something that comes out months to a year later.

<comment><USER10> I came into the development world via anime (years ago). Would you want to talk about some of your ideas? I have always had a heart in this niche.

mikelbring [at] gmail.com

<comment><USER11> As a matter of fact, so did I, how interesting! I started web development a few years back running a little site providing anime, however, I had to close it down because it got too popular and there were a lot of DMCA complaints and such, I was one of the main competitors of Crunchyroll, but I guess Shinji took the legal initiative before I did.

</comment></comment></comment></comment><comment><USER12> _"The hope is that the remaining 30% that will never make back their budgets will get paid for by the successes. This is a gamble, but it's the most essential one of every entertainment industry: a few huge hits that subsidize tons of losers."_

If this figure is accurate, then it represents a far better hit rate than what the US movie and TV industries usually achieve. (The rule of thumb in the US entertainment industry is that less than 25% of TV pilots makes it to the airwaves, and of those, a very small percentage last a full season; an even smaller percentage of those last more than a full season; a fraction of those, still, last enough seasons to become financially successful. I can't recall the film industry hit rate off the top of my head, but I believe the going theory is that 4 in 5 films will fail, and the remaining 1 must subsidize those failures).

In fact, I think the US entertainment businesses will need to learn a lot from the anime business. As distribution techology becomes more sophisticated, we're going to enter a world where two things happen: 1) opinion leaders within a certain genre (superfans, otaku, loyalists, diehards...whatever we want to call them) will discover new content via collaborative filtering as seen on Netflix, iTunes via the Genius algo, etc.; and 2) those folks will, in turn, share their discoveries with linkminded friends via social networks. These distribution patterns will be less than kind to the mass-market, "shotgun" approach as it's been practiced by Hollywood firms for nearly a century. Conversely, they'll be much kinder to niche-portfolio production and marketing. To patio11's point, this will mean resources being devoted to product differentiation: basic stuff for the casual fans, and more limited- edition, souped-up stuff for the _otaku_ (where the real money gets made). It'll also mean that entertainment firms will need to get _very_ serious about high-involvement CRM with their otaku bases, as video game companies currently do. (To some extent, this has already been happening in recent years, i.e., with everyone in Hollywood's annually bending knee to the kingmakers at ComicCon).

</comment><comment><USER13> If you finish reading this article and want more, don't forget to go back up to the top and click on the links to Part 2 and Part 3.

<comment><USER14> Especially of interest to HN readers is Part 3, which is about the economics of streaming anime - the ad-revenue numbers they present are shockingly low.

</comment></comment><comment><USER15> This was a interesting read! Thanks for sharing! I wonder if there is something like this that speaks to manga.

</comment><comment><USER16> How does Anime make money from the US? It seems everyone I know in the US who watches it does so illegally.

<comment><USER17> I always found Anime piracy kind of impressive since they not only have to rip the material, they have to provide English subtitles, too. Which requires special expertise and is extremely tedious. And people do this work for free.

<comment><USER18> I find them amazing too - the tools (last i looked) weren't all that impressive, so a lot of manual work is involved.

in my eyes, these fan sub groups aren't classified as pirate (nor are the peopel downloading them), because as far as i m concerned, the anime is recorded off free to air tv, and thus is meant to be freely available to watch. Add to that the fansubbing + cute karaoke, its a product it itself. The american distributors barely make the mark when it comes to anime distribution, and so no one i know buys anime dvds, and only ever watch fansubs.

<comment><USER19> _in my eyes, these fan sub groups aren't classified as pirate (nor are the peopel downloading them), because as far as i m concerned, the anime is recorded off free to air tv, and thus is meant to be freely available to watch_

Most legal systems come to a different decision from you about whether or not this is copyright infringement.</comment></comment></comment></comment>


Ask HN: What does hackernews use to manage database schemas? - <AUTHOR> What do you guys use to track your database schema changes? Personally I've used custom scripts and alembic before. Recently I've been looking at some products like redgate https://www.red-gate.com and https://flywaydb.org. I've also found smaller services: https://hyperclone.com and many stack threads: https://stackoverflow.com/questions/175451/how-do-you-version-your-database-schema. It seems like most of the solutions have a large overhead and there seems to be a lack of consensus about how to track schema changes. What do you guys do/use to manage database schemas? <comment><USER2> Liquibase</comment>


California Law to Protect Immigrant Home Cooks May Help Tech Giants Instead - <AUTHOR> https://www.latimes.com/local/lanow/la-me-ab626-immigrants-reality-20190218-htmlstory.html <comment><USER2> "Tech Giants" is being used in agreement with virtually no reasonable definition of the phrase. For those who didn't read the article, the bill allows people to sell up to 50k a year of home cooked food with relaxed licensing restrictions. The author argues this bill will do virtually nothing to help independent dumpling makers, tamale vendors, etc while the bill is being advertised to help these types of business owners. Instead, the bill was essentially written as a carveout for a startup called Josephine.com which is a marketplace for homecooked meals. The company is currently out of business, so it's hard to see how it could be characterized as a tech giant. A bit of research turns up 3.1 million in seed funding. [1]

I acknowledge the author's argument here, but they're really decrying the the fundamental nature of an open democracy. This bill was a direct gimme for the startup, but it actually doesn't seem to be a bad thing. A business that lots of people want to patronize now gets to operate legally. I find it hard to see how that's a bad thing.

[1][https://www.crunchbase.com/organization/josephine#section- ov...](https://www.crunchbase.com/organization/josephine#section-overview)

<comment><USER3> Is it a good bill though?

I don't know what we demand in terms of permits, but ensuring that many small vendors are actually taking food safety seriously is generally harder than for a few large vendors.

I like the idea of using existing kitchens more efficiently, but I do wonder what caused home kitchens to be banned in the first place.

I'm also not really sure what can be done about undocumented immigrants who are living off the grid in fear if the authorities knowing about them. Exempting them from food safety laws doesn't seem like the right option.</comment></comment>


Citigroup Sues AT&T for Saying 'Thanks' to Customers - <AUTHOR> https://www.techdirt.com/articles/20160613/06415734694/citigroup-sues-att-saying-thanks-to-customers.shtml <comment><USER2> The headline is pretty misleading. AT&T is launching a loyalty program named similarly to Citi's, which could be confusing, in part because there are co- branded Citi/AT&T credit cards.</comment>


Researcher Makes a Career Developing Cocaine Vaccine - <AUTHOR> http://singularityhub.com/2011/07/24/researcher-makes-a-career-developing-cocaine-vaccine-but-pharmaceutical-companies-won't-produce-it/

<comment><USER2> Summary: bind deactivated cholera proteins to cocaine in the blood. The resulting particle is too large to pass the blood-brain barrier and will be "eaten" by the immune system. Thus, cocaine doesn't do anything for people with these proteins in their bloodstream.

This is currently in phase II trial, with good results. The only issue is that some addicts react by taking huge amounts of coke in an attempt to overwhelm the proteins... so finding a big company to produce it and take it into phase III trials is proving difficult.</comment>


Beating the Arc Challenge in Clojure - <AUTHOR> http://www.bestinclass.dk/index.php/2009/12/beating-the-arc-challenge-in-clojure/

<comment><USER2> This really shouldn't be labeled "beating" (note, neither the Ruby nor Go versions claimed such). This takes more parse tree entries than the Arc version, which was the metric defined there.

</comment><comment><USER3> I wouldn't say "beating" so much as "playing", since the challenge is to compare the length of the programs that accomplish the task. Your compojure solution accomplishes this at the request level, passing data between request handlers using session variables. The current arc solution has only one request handler for the entry point, and then uses temporary anonymous handlers to chain the session. This is something which could probably easily be added to compojure, since clojure has language features similar to arc.

</comment><comment><AUTHOR> Please notice the 'update' sections, where Compojures Sessions Middleware has been implemented.

<comment><USER4> In the arc version you can navigate to the same url in multiple tabs, and each of those tabs will work independently. In order to make that work you need, in addition to the per-user session, a per-page session.

It probably makes more sense if you look at an example. Take a look at the multicounter example for seaside:

         http://seaside.st/about/examples/multicounter

Notice the automatically generated k parameter that appears in the URL when you press one of the ++ or -- links. That is the id string for the per-page session.

Scroll to the bottom of that page and you will see the code. I would love to code web pages like that. Compojure is not up to the challenge, and I don't think that weavejester is interested in changing that. Compojure is designed for REST applications, and we are talking about the polar opposite of REST.

Edit: Of course I also should have included seaside's answer to the arc challenge:

         http://www.lukas-renggli.ch/blog/take-the-arc-challenge</comment></comment>


Breaking the Salary Sharing Taboo - <AUTHOR> https://www.nytimes.com/interactive/2020/02/19/magazine/salary-sharing.html <comment><USER2> I used to be open about my salary, until it went wrong.

In my first two companies I would openly share my salary, which worked in my favour since I was underpaid. In my third company, where I had one of the higher salaries, it didn't work so well.

My colleagues refused to share theirs (it transpired they were making less), and that led to a lot of animosity and bad blood. Ever since I don't share anymore, most people have the tools they need online to make an educated guess on how well they are getting paid.

<comment><USER3> If you don't mind telling, how did that result in animosity?

<comment><USER4> "You shouldn't be making that much! I'm doing just as good a job as you!"

(narrator: They didn't)

<comment><USER5> That's an interesting take

"you shouldn't be earning more than me"

rather than

"I should be earning as much as you"

I wonder why (some) people immediately think the former

<comment><USER6> Agency and effort. Or rather, let's change the latter statement so it sounds less entitled: "Why am I not earning as much as you? I should be able to"

The latter statement requires the speaker to admit they screwed up. They can get to that point, if they did research on how to get there or worked on the key things they are missing currently. The former statement puts the agency on the opposing party and basically expects some divine will of the heavens to strike them down for their sin of earning more. Most people don't want to change or admit their own mistakes. Or worse, they are indoctrinated by Calvinism.

<comment><USER7> This is all very self-indulgent. People don't get paid what they're worth, they get paid the smallest amount someone can get them to accept.

<comment><USER8> Just what do you think the word "worth" means?

<comment><USER5> The amount of value they add

Company X needs to employ two people in a role. The person they employ will add $100 an hour of value to the company.

Person A has lots of money in the bank from a large inheritence and doesn't need the job to live

Person B has desparately needs a job to pat the mortgage

Company X offers both $40 an hour

Person B takes the offer, as the alternative is reposession

Person A says 'no'

Company X still wants that extra $100 an hour of value, so offer person B $50 an hour, then $60. Person B then accepts at $60.

Both person A and person B are worth $100, neither get paid what they are worth, but person A is paid 50% more than person B.

<comment><USER8> So if a crippled person needs somebody to go to the bank and withdraw $1,000 for them, and they figure they can hire somebody trustworthy for $50 to do the errand, is that person not being paid what they're worth, because they added $1,000 dollars of value?

If person A in your narrative was capable of creating $100 dollars of value all by themselves, they would do that instead. But they can't. The $100 opportunity exists because of the company.

The company needs a shovel strong enough to dig up the $100. If one person will sell such a shovel for $40, and that's the best price available, they'll take it. That was the market value of shovels. It would be wrong to say the shovel was worth $100. Even if all the shovel sellers in the area knew about the details of this opportunity and decided to set they're prices at $99, it would quickly become apparent that shovels aren't really worth that. Two things would happen: sellers would defect and set they're prices lower than $99 to secure the deal; this would happen as long and there was still and profit to be made. And the company would remember what a shovel was supposed to cost, get suspicious, and look in to manufacturing a shovel of they're own, or commissioning a rake shop to make one.

This game of price setting is pretty good at approximating worth, especially compared to your proposed strategy of measuring the delta between company profits in reality, and in an alternate reality where the employee didn't exist and the company didn't attempt to fill their position with anybody or anything. The latter is not worth talking about.

<comment><USER9> _So if a crippled person needs somebody to go to the bank and withdraw $1,000 for them, and they figure they can hire somebody trustworthy for $50 to do the errand, is that person not being paid what they're worth, because they added $1,000 dollars of value?_

This is a terrible example. Moving something is not the same as creating that something. Moving $1000 could be worth nothing. It could have negative value. It could be worth millions.

<comment><USER8> Right, and there are many things in between. Maintaining an object, improving an object, combining objects to make complex object, etc.

If you're in the business of creating useful objects out of basically nothing, you don't even need a company. Maybe you hire somebody to sell your objects for commission, or maybe you sell them yourself.

If you're looking for a closer analogy, try the shove analogy. Why is it that despite the fact that the shovel makers are creating an object, even out of nothing, that they aren't worth what is dug up with them? Software engineers are a lot like the shovel makers. Sometimes the shovels we make are used in extraordinarily profitable ventures. But their value is still determined by how hard it was to make them, and to learn the skills to make them. Not what the company uses them for.

I think it becomes hard to see when all the shovels being made are bespoke. Lots of software is written to fill one role for one client. That client will often use that particular thing to make lots of money. So maybe it appears like that thing bit of software created all the value? But this is clearly false. The fact that some part of a system is essential to the whole system's success does not imply that the worth of every piece of the system is equivalent to the worth of the whole system.

<comment><USER10> This is a good way of putting it. All these "run your own agency" self-help courses have been pushing "value based" pricing with the promise that you can slap together a Wordpress template and charge $40k for it because of the "value" a website brings to the company is mostly nonsense IME. Stuff is built by the lowest competent bidder, period.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> There are two incentives at play here: A company obviously wants to pay as little as possible. So if there are employees that do not realize they are underpayed it benefits the company in the short term. On the other hand, employees who feel they receive a good salary or any other extraordinary benefits do not want to publicly talk about this fact to not alienate their colleagues (who they suspect earn less).

Public salaries on the other hand reduce a company's flexibility: When negotiating a new contract, they cannot offer 10% more anymore. On the other hand, no one should apply if the salaries do not match their expectations...

I guess it can work reasonably well, but individual cases would suffer somewhat.

<comment><USER12> > _A company obviously wants to pay as little as possible._

I suppose I'm naive, but it seems obvious to me that a company should want to pay its employees as _much_ as possible—that is, as much as is consistent with the value the employees deliver. When I say "should", I don't mean morally. It just seems obviously in the company's interest.

<comment><USER13> You're reminding me of the "Spanish Theory of Value" as explained in the book Peopleware (DeMarco & Lister). I highly recommend this book.

From Chapter 3 of the book: "The Spanish Theory...held that only a fixed amount of value existed on earth, and therefore the path to the accumulation of wealth was to learn to extract it more efficiently from the soil or from people's back."

I think that most folks, once they're a few years into their careers, have seen and understood that this theory of management and value extraction is alive and well in corporate America today.

From the same chapter: "Productivity ought to mean achieving more in an hour of work, but all too often it has come to mean extracting more for an hour of pay. There is a large difference."

So I agree with you. It seems obvious to me as well that companies _should_ pay as much as possible. But they don't think that way, because they're coming from a different value set.

<comment><USER12> Even the value set of greed should nudge them in that direction—though perhaps not short-term greed.

<comment><USER13> Again, we agree. But it's that word _should_ that is the delta between how we would like it to work and how it currently actually works.

</comment></comment></comment></comment></comment><comment><USER14> If our starting point is to agree that people are individual in their experiences, competence, what they can bring to a team, then it follows that salaries are a subjective value attached to each individual.

With this approach it is our task to come to the negotiating table:

\- informed on floor and ceiling for the position's compensation (there are websites and unions and many ways to get this info besides asking)

\- ready to show what I can bring of value that it's worth paying more than a mere floor compensation, or above the ceiling.

In the past I've only shared information with people I know will be discreet in how they use it, and it has helped them, and it has helped me. The interesting thing is that most of these cases are internal moves. You can't just ring people in the company you are interviewing for and ask...

</comment><comment><USER15> I'd be frustrated with my colleagues to know how much they make and they'd be frustrated with me. Job titles jr, 1, 2, sr are frustrating enough. I'm always surprised when I learn a great engineer is only a 1. Management uses grades like a carrot and stick. I'm all for giving people with the same job the same title.

Public grades/salary on the other hand makes it hard to work with people. You can't look at another person without thinking of their worth and compare it to yours. It creates unnecessary drama, makes people think they're more important than they are, and distracts from the actual work. Glassdoor and recruiters already should give you a good idea of what you're worth. Knowing other people's compensation will only lead to jealousy of others and others of you. It's one of those human nature things that can't be turned off so best not to exacerbate it.

<comment><USER16> Personally I don't consider my salary a secret. Even though my colleagues newer shared their salary with my, they've always gotten an honest answer if they asked my.

Apparently those of my colleagues who now know what I make believes that I'm under paid by around $1000 per month. At the same time I feel that my pay is excellent and that my co-workers deserve every cent they make.

Drama around people salaries could arise, but only if your company rewards people randomly. Knowing that a colleagues makes more than you should prompt you to ask your boss what it is that you're doing or not doing that keeps you at a lower pay, and your boss should be able to tell you exactly why you're paid less.

In my experience recruiters and public salary databases isn't that useful. Most large organisations have their own, or buy access to salary statistics and will use those. In my case recruiters have been off by as much as $15000 per year, not including existing bonuses and overtime.

Salaries should in my mind should be public. I believe it will result in more equal pay, but also lower salaries to a large group of people who currently enjoy a salary that isn't reflective of they responsibility or the importance of their job.

<comment><USER15> "your boss should be able to tell you exactly _why_ you're paid less."

'Why' is a qualitative measurement. You will never agree. The debate will never end. It will always be well be, "he did X, I did Y, I think Y is more important, so I think I should be paid more" times a thousands of employees.

Believe me grades are a public salary microcosm. I worked at a company for 4 years that added grades to titles in the middle of my stay. It was a disaster. People were never happy, always jealous, constantly asking their boss 'what they need to do' to achieve a subjective thing.

I think you're right it would lead to more equal pay because that would be the only way to avoid the drama. It does put the company at a competitive disadvantage now because -

      Your competitors know how much all your positions make, while they don't have to make theirs public
      Hiring a dev at a discount is impossible because they will complain
      Hiring a dev at a premium is impossible because current employees will complain
      Holding on to talent is harder because if they leave for a better offer - you cant match their pay because everyone else will complain

Really the only way this isn't a problem is if you're underpaid - like you are. And like I said there are many services out there that will give you a good idea of range you should be paid.

</comment></comment></comment><comment><USER17> I never understood this since I worked for the US military for 22 years. Everyone knew exactly what everyone else made, including extra duty pay, housing allowances, bonuses, etc.

We never bitched about the pay someone else was making. It was just the way it was.

<comment><USER18> Software devs are totally not like military personnel. Marketing people are not like military personnel. Of course I assume there is bunch of a-holes in mil and people who try to game the system. I never been to military but I assume there are much more clear rules, ofc your superior might like you more and you get promoted, but there is no ranks or requirements written down in business so amounts of gray areas is much larger there.

</comment></comment><comment><USER19> As a member of academia where our (low) salaries are published in a government website, I find it rather strange to know that in private companies the salaries are not public. You mean that different people doing the same job earn a different salary? How is that even possible? How do people put up with this bullshit?

<comment><USER20> There are arguments on both sides. We want to make sure that companies don't offer lower salaries to immigrants, blacks, women etc. On the other hand, productivity varies wildly among different people doing the same job.

<comment><USER19> > On the other hand, productivity varies wildly among different people doing > the same job.

But then they are not doing the same job, and it is reasonable that they earn more.

In a grocery store, the prices are public and visible to all clients and other stores. You are reasonably sure that the seller is not reaching a "private agreement" with most other clients. This kind of public information is a basic tenet of a market economy. Otherwise the whole thing is taken over by arbiters (aka "negotiators") instead of productive people. I honestly do not understand why such an important part of the economy (the actual salaries!) is not bound by the same rule.

<comment><USER21> > But then they are not doing the same job, and it is reasonable that they > earn more

The issue is wether everybody realizes they aren't doing the same job.

> In a grocery store

Comparing performance of people is a lot more subjective than comparing food. Your comparing apples to oranges here.

If performance was easy to compare, it'd be a lot easier to push for transparent salary information.

<comment><USER19> > If performance was easy to compare, it'd be a lot easier to push for > transparent salary information.

If performance is not easy to compare, what is the point of assigning different salaries to people?

<comment><USER22> Because people's performance is different, even if it's hard to reduce that to a numeric score in a totally objective way.

When I look back over my career, I know which 20 or so engineers I'd want to hire for a startup where engineering mattered. Even if I can't assign an exact percentage how much better they were, I sure know who they are.

</comment></comment></comment></comment></comment></comment><comment><USER12> An article with a similar title from 5 years ago: [https://news.ycombinator.com/item?id=9926192](https://news.ycombinator.com/item?id=9926192)

<comment><USER23> So this seems to be a long trending topic and still without an answer

</comment></comment><comment><USER24> It's pretty safe in places with very strictly tiered salaries. The more performance driven it is the less safe it becomes because everyone thinks they're the best.

<comment><USER25> I don't think that's true. In fact, I believe most people think they are less performant than their peers.

<comment><USER24> A case could be made for either - impostor syndrome on one hand, massive ego on the other. The ego side is what kicks off the problems in this debate though.

But yes, perhaps it's less than 50%. Hard to tell

<comment><USER26> My experience comes down on the ego side in general, that is, there are more people who (massively) over-value their ability and contribution than there are people who (massively) under-value theirs.

That may depend on industry and location though. Different jobs are likely to attract different people.

</comment></comment></comment></comment><comment><USER27> I really like the idea of salary transparency, and I honestly don't mind if someone is making more than me (as long as I don't feel neglected). However, I was once hired at a company and had to move from across the country from a place I loved living to a place I wasn't sure about. So I negotiated everything I could. I asked for more time off (didn't get it), I asked for a higher salary to cover the cost of living in this new location (got it), and a few other things. I felt pretty good about the negotiation and I was being hired for a very specific niche skillset that would help the company a ton. Not long after I was hired, I learned I was making as much or more than people who were more experienced and probably more talented than me... and as casual as I am about pay, not everyone is, so I shut right up about it. I guess my point is that not everyone will push as hard as me or be as fortunate as me and there's just a lot of factors to consider. I wish it wasn't like that sometimes, but I'm this case I got a much better gig than I would've otherwise.

</comment><comment><USER28> From the company's point of view this seems like a very bad idea. It essentially cripples their ability to attract great talent.

In order to avoid drama in the workplace, companies adopting this sort of policy would undoubtedly adopt a standard pay scale that excludes their top workers. Maybe the existing employees are grandfathered in? Or maybe not. In either case you end up not being able to spend extra on that one employee who could really help your business goals.

And I say that as a person who pretty freely shares what they make (though not typically with current coworkers) and also earns well above average in my region.

Just imagine having the sorts of discussions we have about ostensibly-overpaid NFL players, except about George in Logistics and you'll start to see what I'm imagining.

<comment><USER29> > Just imagine having the sorts of discussions we have about ostensibly- > overpaid NFL players

While bad from a companies point of view, salary transparency is one of the few free market mechanisms in sports, and it does generally result in meritocratic distribution. The very fact you can mention someone who is perceived as overpaid implies scrutiny far beyond anything possible in a major corporation.

Frankly, I suspect this would be worse for company profits more than anything else. In sports they have a strict % of total revenue that salaries can come out of,which limits the pot. Employees would certainly have no such artificial limit, in fact such a thing would likely be illegal.

</comment></comment><comment><USER30> This taboo about salaries seems only to exist in places with big salary disparities, and/or where salaries are closely tied with self-worth.

In Russia, for example, "how much do you make" is a question as common and unusual as "What city are you from?"

<comment><USER31> Yes, in Russia many impolite people tend to ask that, but the usual response it "just enough" or something vague. Maybe factory workers share that easily, but in high salary circles it is also a taboo. Maybe because it's so much above country-wide average that one had better be silent about that. Lived in the country until last year.

</comment></comment><comment><USER32> To get a better sense of my salary range,I found talking to recruiters very helpful - especially those whose bonus is tied to their prospects' future salary. In my current job, that number was a really exact estimation.

</comment><comment><USER33> From the article: "a business that offers feminist-minded co-working spaces".

How should I imagine a feminist minded co-working space?

<comment><USER34> Remember when Google did a company-wide study to find out for how much women at Google were underpaid? And it turned out that women in the same job were actually earning much more than their male colleagues doing the same thing.

Now imagine "open salaries" making it obvious that the "women underpaid" is just a lie. An entire industry of "feminism" would die.

Maybe NYT should not push too hard for this "openess".

<comment><USER35> > earning much more than their male

less than 1% is not "much more". Please don't editorialize. Especially when the data I have (and I have more than most!) on Google's internal salaries shows that women do appear to be underpaid by some measures.

<comment><USER34> What are those "some measures" and where is the 1% coming from?

<comment><USER35> "We provided $9.7 million in adjustments to a total of 10,677 Googlers." -> just under $1000 per adjustment, on average. Note that since the comment here is that the affect group (L4 men) was large and led to the majority of the changes, we can generally discount ideas like "oh there were a small number of massive adjustments and a large number of tiny ones", or we can believe that's the case, but then the L4 men adjustments would be smaller on average, not larger.

The average L4 SWE at Google is taking home more than $200K annually, and has a salary well over 100K, so these changes amounted to less than half a percent of total comp, and less than one percent of salary.

As for "some measures", the short answer is that when you control for performance rating and level, as Google did here, things generally look reasonable.

The problem is that there are good reasons to believe that historically equally performing women were less likely to be promoted (for various structural reasons that I won't get into, weren't malicious, and have been at least somewhat addressed). The result then is that high performing women may still be under-leveled or under-compensated in relation to their actual performance.

So a completely reasonable interpretation of this sequence of events is that women were as a group, somewhat under-leveled. Their managers, individually, noticed this and did (as Google leadership suggests) what they could to use manager-discretionary compensation to address this underpayment. Again, individually and stochastically. The overall analysis notices this, and because one stochastic process (promotion) previously had a bias against women, and because the recent analysis didn't control for that, I get an extra $1K.

Which is nice, but it's not anything particularly special.

<comment><USER34> > equally performing women were less likely to be promoted

So they disproved the "wage gap" lie with hard data, and, as if nothing happened, you pull out the next unfounded myth?

Got any hard data?

<comment><USER35> No, they showed that Google doesn't have a gender wage Gap when controlling for performance. This doesn't disprove anything in general. Nor did it address preexisting concerns that aren't myths.

And yes, but not publicly.

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> So is Susan Dominus willing to disclose her salary at the NYT? I doubt it. She's probably one of the better paid and it would create quite a bit of jealousy.

</comment><comment><USER37> ignorance is bliss</comment>


This Teenager Became the First AI Creation to Pass the Turing Test - <AUTHOR> https://www.fastcompany.com/3031650/this-teenager-just-became-the-first-ai-creation-to-pass-the-turing-test <comment><USER2> Unfortunately fake. Also, convincing just one Judge isn't really great success.

"Update: It turns out that the judges and test were as artificial as Eugene. The event was organized by a well-known prankster. We regret having been duped. On the other hand, chatbots on Twitter are fooling humans into thinking they are real all the time. "</comment>


Free DNA tests - <AUTHOR> https://medium.com/genomics/dna-tests-for-free-175af5f3412e <comment><USER2> that would be interesting, if it didn't require facebook</comment>


Show HN: A transit assistant app for commuters who use the GO Transit in Toronto - <AUTHOR> http://hopongo.ca <comment><AUTHOR> Hi guys we built this app to be a companion transit app for the daily commuter who uses the GO Transit in Toronto. I know it's bit niche but wanted to share it with the HN community since we are long time HN fans. Feedback would be appreciated! Also it's iOS only for now but we are working hard on Android to get it done asap! Thanks for checking us out :)</comment>


Advanced Financial Modeling for Free (By Nvest) - <AUTHOR> http://www.nvest.me/modeling

<comment><USER2> Great site</comment>


Bringing OpenID To The Masses: Clickpass (YC summer 07) - <AUTHOR> http://www.techcrunch.com/2008/03/11/clickpass-could-change-the-way-you-surf-the-web/

<comment><AUTHOR> We are on Disqus, news.yc and plaxo at the moment.

If you want to skip the intermediate pages, <http://disqus.com/login> and <https://www.plaxo.com/signin> :)

<comment><USER2> I can't seem to get this to work on news.yc, at least with my self-hosted OpenID (<http://openid.dfranke.us>). I go through my portal and then the Clickpass portal and get redirected back to a news.yc closure URL, but it just gives me a blank page and doesn't log me in.

<comment><AUTHOR> I just found a workaround and fixed it. Sorry for the delay

</comment></comment></comment><comment><USER3> >Naturally some concerns arise with any centralized login system. Doesn't this mean a thief only has to steal one password, your Clickpass password?

Clickpass with two-factor security (e.g. SecureID) might be worth paying a subscription fee for

</comment><comment><USER4> Seems to me now that the HN post yesterday on Techcrunch was more of a preparation to announce Clickpass and lure more TC users on its service.

Nice one-two movement.

<comment><USER5> I assume you're joking, but in case you're not: it was a coincidence. We didn't ask to be TechCrunched.

<comment><USER4> It was just an observation. I think it is even better that it was a coincidence. As the saying goes: "the harder you work, the luckier you get".

But even if it wasn't, I couldn't say that there was something unethical or shady about it. Sorry if it seemed that I was implying something like that. It was far from my intention.

<comment><USER6> TC has always been very kind to YC and its startups. They seem to take the view that startups are going to have a hard enough time without their first media appearance ripping them apart over the usual early startup pains and problems. TC readers that comment, on the other hand, are like a more vicious and less literate TMZ that somehow views startups profiled at TC as "the other half" who don't have to work for a living. Not entirely relevant to this thread, but I've been pleasantly surprised by how nice the TC folks are in print and in person, and they're enthusiastic about the whole YC concept.

</comment></comment></comment></comment><comment><USER7> For me, the whole idea of openID is flawed from the start. Why would I want _one_ point of failure? Why would I want to use the same login details for every site I go to? That's kind of a very bad idea.

Sorry, but the whole openID thing seems like tech people making tech things that they think are technically impressive. Rather than things that are useful or solve problems for the average Joe.

There are enough password reminder/generator addons/programs etc, and most browsers have such functionality these days.

Am I missing something?

<comment><USER8> 1\. 99% of people use the same login details on every site they go to anyways. That's not likely to change. For those people OpenID is actually more secure, since their password is only ever exposed to one site.

2\. Your email address is already a single point of failure for any sites with a "Forgot my password" function.

IMO an OP can be made secure enough that the benefits of OpenID outweigh the severity of a possible breach (at least for non-critical transactions).

<comment><USER7> Good points. So I guess the challenge is either to convince users that OpenID gives them some advantage to just using their same old login details, or convince website owners that it is a good idea. I guess we'll see how it works out...

</comment></comment></comment><comment><USER9> And it works with news.yc.

<comment><USER10> Actually, it didn't for me. I click on "log in", then click the Clickpass drop-down, type in my own OpenID, it goes through to MyOpenID and verified that.

Then it takes me to the "merge with your existing Hacker News account", and I type my correct username/password, but then I get redirected back to News.YC and a blank page at something like <http://news.ycombinator.com/x?fnid=j3tO1pS8ox>

<comment><USER11> A friend of mine had this same issue

<comment><AUTHOR> hmm, I see what the problem is.

My apologies, arc is a tricky language :). I am going to fix it and hopefully pg will be able to push it soon.

<comment><AUTHOR> It works if you are logged in to Clickpass btw. But it was a mistake, gonna fix it :)

</comment></comment></comment></comment></comment><comment><USER12> Congrats! Clickpass is going to be big.

</comment><comment><USER13> I can't seem to get my news.yc username linked up to my OpenID. I login to my OpenID provider, then get to the point where I enter my news.yc username and password, but then it takes me to a blank page on news.yc. :(

</comment><comment><USER14> Looks like logging in with the AOL OpenID provider doesn't work on news.yc. I don't know if this is a news.yc bug or AOL OpenID bug.

</comment><comment><USER15> Clickpass feels more like a single-sign-on service, wasn't the purpose of OpenID to negate this? Or am I missing something here?

<comment><USER16> Hi Spif. Clickpass is a single-sign-on service. It's built on the OpenID protocol.

<comment><USER15> Thanks, I did get that part :-) I'm wondering though why this would be a success where MS passport failed. Because it's not evil? Is usability the only left that hampers uptake of openID?

<comment><USER17> Well I haven't had an OpenID until now.

Here's what I think you're saying: A feature of OpenID is that, unlike passport, there is more than one ID provider. With Clickpass, although you can use a generic OpenID the normal way, it works best if you have a Clickpass account.

<comment><USER16> That's a pretty good description Alex. We've tried to minimise the feature set and whilst we've made sure that people can use their own OpenID if they want to we figure most users won't. If it turns out that they do we'll switch to making it an automatic feature.

</comment></comment></comment></comment></comment><comment><USER18> Peter Nixey: The UK's prodigal son, no? Congratulations to Clickpass. Looks like a good service.

</comment><comment><USER19> great writeup -- congrats peter and immad!

</comment><comment><USER20> How do YC companies get on TC so easily?

<comment><USER21> Because Michael Arrington is in love with Paul Graham.

It's a secret affair, of course.

</comment></comment><comment><USER22> Great stuff, way to go Peter and Immad!

</comment><comment><USER23> I like it. Congrats guys.

</comment><comment><USER24> this is gonna lead to a lot of dumb old ladies sending you spam because they gave away their password. Can't wait!!!</comment>


Tortoise shows kids that robot abuse is bad - <AUTHOR> https://techcrunch.com/2018/03/20/this-tortoise-shows-kids-that-robot-abuse-is-bad/ <comment><USER2> The real trick is that making skinner boxes look like turtles makes them an easier sell to parents.</comment>


Why I'm wrong about Lodsys and everyone should go bankrupt fighting them - <AUTHOR> http://www.marco.org/2011/05/23/why-marco-arment-is-wrong <comment><USER3> So the post title is tongue in cheek...Marco, you bummed me out once again!

As a small shop, I don't know what I would do, but I do know this - <USER2> over seems like the worst option.

#1 - I'm infuriated that Apple continues to stand back and watch their developers get attacked. More infuriated that they haven't backed off of their stance that the in-app purchase is the only way to sell something in the app.

#2 - This patent is bullshit, and everyone knows it. Sometimes, you have to do what's right, regardless of the stakes.

<comment><USER4> It's not the worst option at all, it's just the best of a bunch of bad ones. As a small software company CEO I have a fiduciary responsibility to my shareholders to maximize revenue, not to take stands against patent abuse. If my options were pay a small fee to someone who didn't deserve it, or go broke trying to fight it (no matter how right I am) I'm choosing the former.

It's unclear here what is right, even if you assume the patent is total bullshit. Is spending the money your investors gave you, and that your employees depend upon for their livelihoods, to fight a (probably) unjust patent claim right? It seems you're trying to make a right out of two wrongs there. It's certainly foolish from a profit-maximizing standpoint, and it's hard to imagine it's going to have any positive effect on the patent system even if you win.

<comment><USER3> Your case might be different because you are incorporated (I'm guessing) and in a different position than many indie shops.

In my business, the only shareholder is me, as is the case with many developers that were targeted in this suit. Investors and employees has nothing to do with it.

Lastly, as I said above, this isn't even about winning.</comment></comment></comment>


How parking rules raise your rent - <AUTHOR> http://www.sightline.org/2013/08/22/apartment-blockers/ <comment><AUTHOR> _The High Cost of Free Parking_ ([http://www.amazon.com/High-Cost-Free- Parking-Updated/dp/1932...](http://www.amazon.com/High-Cost-Free-Parking- Updated/dp/193236496X)) is mandatory reading for anyone wondering about why the rent is too damn high.

</comment><comment><USER2> Two parks for a 1-bedroom conapt sounds excessive.</comment>


HTTP headers for the responsible developer - <AUTHOR> https://www.twilio.com/blog/a-http-headers-for-the-responsible-developer <comment><USER3> I have been trying to explain the importance of HTTP headers to some younger/junior devs I am working with. I have noticed that headers are often considered to be 'too technical' or even 'old tech'.

I'm going to recommend them to read this, but I do think I need to explain a couple of things that the article is not clear about:

\- Be sure that you understand the concept of HSTS! Simply copy/pasting the example from this article will completely break subdomains that are not HTTPS enabled and preloading will break it permanently. I wish the authors made that more clear. Don't use includesubdomains and preload unless you know what you are doing. Scott Helme also did a great article about this [0].

\- CSP can be really hard to set up. For instance: if you include google analytics, you need to set a script-src _and_ a img-src. The article does a good job of explaining you should use CSP monitoring (I recommend sentry), but it doesn't explain how deceptive it can be. You'll get tons of reports of CSP exceptions caused by browsers plugins that attempt to inject CSS or JS. You must learn to distinguish which errors you can fix, and which are out of your control.

\- Modern popular frontend frameworks will be broken by CSP as they rely heavily on injecting CSS (a concept known as JSS or 'styled components'). As these techniques are often adopted by less experienced devs, you'll see many 'solutions' on StackOverflow and Github that you should set unsafe-inline in your CSP. This is bad advise as it will bascially disable CSP! I have attempted to raise awareness in the past but I always got the 'you're holding it wrong' reply (even on HN). The real solution is that your build system should separate the CSS from JS during build time. Not many popular build systems (such as create-react-app) support this.

\- Cache control can be really hard too. If you don't have time to fiddle with these settings, I recommend using a host like Netlify, they seem to do a proper job at caching in my experience.

[0] [https://scotthelme.co.uk/tag/hsts- preload/](https://scotthelme.co.uk/tag/hsts-preload/)

edit: typos

<comment><USER4> > Be sure that you understand the concept of HSTS!

Instead of using HSTS, you can also simply redirect any HTTP request to HTTPS. That way, you are certain that HTTPS is used, even if a browser does not understand HSTS.

<comment><USER5> This will leave your users vulnerable to man-in-the-middle attacks. If I control the router between their computer and the Internet, I can serve back a HTTP page which doesn't redirect, and trick them to enter their password (for example).

HSTS is designed to prevent this.

<comment><USER4> How can HSTS prevent a man in the middle attack if the server has not even been contacted yet?

<comment><USER6> It can only do that if you add it to the preload lists of browsers (which is mentioned in the article).

But even if it is not, it's still helpful for people connecting to your site again.

<comment><USER7> And because the preload list is hierarchical whole swathes of the Web can be covered with a single entry. .dev is the biggest example, but they can protect all the stack exchanges, all the default blogspot blogs, that sort of thing.

</comment></comment></comment></comment></comment></comment><comment><USER8> To me this just seems like more duct tape over the fact that everything on the web is doing things it wasn't really designed to do. We never could have imagined what we would be able to do with HTML/CSS/JS in a browser environment. We also never could have imagined how the pressure of business demands would essentially drive more and more duct tape solutions until the whole web was built on rickety scaffolding all sort of lashed together and swaying.

There are backend bandaids and frontend bandaids but with the sheer amount of stack knowledge and framework knowledge required to do anything as a webdev these days, there's no way to stay on top of it all and we are just kinda winging some combination of best practices and getting shit done.

I don't know if things like PWAs and WASM is going to allow us to move towards a change yet, and would love input form someone with an opinion.

<comment><USER9> > the sheer amount of stack knowledge and framework knowledge required to do > anything as a webdev these days

I think this is greatly exaggerated. You can get by just fine making your own sites knowing some basic html/css/maybe js, maybe some php too if you want backend stuff. Optionally some frameworks if you want, which should usually be easy enough to just follow some examples and get the functionality you want pretty fast.

If you're put on an existing web project, you probably only have to learn the bits immediately surrounding the things you do, picking it up as you go along. I still don't know Angular, React, Vue, or much else in the way of JS frameworks other than jQuery after being in web dev professionally for years, as it simply hasn't been needed.

<comment><USER8> Yeah, sorry if I wasn't clear, but that's kind-of my point. You can make a site by knowing how to use some subset of stuff, but the rest you use as a black box - whether it is importing a bunch of third party libraries or being able to build a web app without understanding how cross-site attacks work, etc etc so at some point you either have to learn these little gotchyas all over the place or they go un-fixed.

Like how many sites still don't have mandatory HTTPS even though it is free and easy?

<comment><USER9> That's no different from programming in any other environment then - <USER2> libraries are generally meant to work like black boxes and security issues etc happen everywhere.

</comment></comment></comment></comment><comment><USER10> Gotta love all the ritual incantations one has to perform to "keep your website safe" these days. Worst of all, people are clearly bragging about possessing this arcane knowledge, instead of constantly complaining about how stupid the whole thing is to begin with. "Responsible developer"? Hah.

The web needs a real security model relevant to what browsers are doing today, not these piecemeal hacks ducktaped to a hypertext delivery protocol.

<comment><USER11> As someone who builds websites for money, I couldn't agree more. I rarely get to bill for making incremental changes, I get to bill for implementing features. Spending money to implement and log a properly restrictive Content- Security-Policy doesn't seem like wise use of my clients limited budget.

<comment><USER12> It may be a wise use if a security break-in would be a problem for your client.

I am a big fan of restrictive CSP, but it's often hard to get there from an existing site. It's often better to do it in stages, e.g., when you work on page Q, you make _that_ page have a restrictive CSP. Later, when you work on page R, that can grow one (or at least have fewer CSP issues). If having someone break into your site would be a serious problem, then you should speed up what it takes to get there.

</comment></comment></comment><comment><USER13> Great article.

Somebody else mentioned Scott Helme, but didn't link to three of his amazing sites:

[https://securityheaders.com](https://securityheaders.com) which checks important headers

[https://report-uri.com/](https://report-uri.com/) which allows sending CSP reports to to catch errors. It also has a CSP builder (among a bunch of tools) which is hugely helpful: [https://report- uri.com/home/generate](https://report-uri.com/home/generate)

[https://scotthelme.co.uk/](https://scotthelme.co.uk/) is his blog with a ton of info. It also has a cheat sheet for CSP: [https://scotthelme.co.uk/csp- cheat-sheet/](https://scotthelme.co.uk/csp-cheat-sheet/)

(I might be a fan of the guy ha)

</comment><comment><USER14> These are great features, but I wish there were better ways to communicate the security policies for my website than having to send lengthy headers with every page.

CSP in particular tends to get rather long-winded. As the article says, it can contain up to 24 policies, many of which contain their own lists! It's bound to get even more complicated as web apps integrate with an ever greater number of external services. Feature-Policy also looks like it could easily balloon to 1KB or more if you wanted to control all the features. No matter how much compression you add, at some point this is going to affect the load time. Additional TCP round trips aren't cheap, especially for HTML resources that usually aren't cached at the edge.

Wouldn't it be convenient if I could store a structured representation (JSON, YAML, whatever) at a predefined location under /.well-known/ and use ordinary Cache-Control headers to make browsers cache the rules?

<comment><USER3> > Feature-Policy also looks like it could easily balloon to 1KB or more

Twitter sends over 6kb of CSP headers on every single request. This is what happens if you run loads of different advertisement and tracking vendors.

<comment><USER15> > Twitter sends over 6kb of CSP headers on every single request.

Now I understand why HTTP/2 uses compression for HTTP headers.

</comment></comment></comment><comment><USER16> I read the whole article just to find out what the X-Shenanigans header shown in the picture at the top of the article is. There was no further mention of it.

Looks like it's an inside joke from Twilio[0].

[0] [https://github.com/kwhinnery/todomvc- plusplus/issues/7](https://github.com/kwhinnery/todomvc-plusplus/issues/7)

</comment><comment><USER17> Aren't advertising networks blocking the adoption of CSP headers? Seems like it's quite a job to maintain the exceptions needed for Doubleclick for example.

<comment><USER3> It is always quite a job to maintain CSP. And it's really easy to break something with CSP.

This is why loads of devs usually throw in the towel and disable CSP or use a unsafe-line. Basically like trying to solve a hard CSS problem and at some point give up and add !important statements everywhere.

It's also really, really hard to explain to customers that it takes time to set up, and every time they install a new tracking/ad/video/whatever plugin on their CMS, you'll have to spend time on adjusting the CSP accordingly.

That said, I do encourage developers to use CSP. It's a really powerful tool to secure your site and protect your visitors from fraud/phishing.

<comment><USER18> It is also at least some level of defense against malicious npm packages (doesn't eliminate threat completely, but at least less sophisticated attacks will be thwarted).

CSP headers are a _very_ useful tool and I encourage everyone to use them. They are a PITA to set up though. Fortunately at least Firefox clearly communicates in console log when a CSP rule is hit, and how to relax it (if it was by mistake).

Note that CSP can be set as META tags too. There's a gotcha though: if they are set in both places (HTTP headers and HTML META tags), an intersection of the rules is used.

</comment></comment></comment><comment><USER19> Developers connect people. Developers help people. Developers enable people.

Look I understand that people in general feel the need to pretend that their work is very important and good but come on. You are not working for Warchild in a Lebanese refugee camp.

</comment><comment><USER20>
      Developers connect people.
      Developers help people.
      Developers enable people.

I don't remember agreeing to these conditions. Is this some sort of psychological manoeuvre to get people to use SSL encryption on the web ?

<comment><USER21> Whilst, if you ever upset one badly enough, you will find that sysadmins disable people.

</comment></comment><comment><USER22> When dealing with user uploads, we still need content disposition headers to force browsers to treat certain formats as attachments, rather than showing them inline, right?

</comment><comment><USER23> I kind of understand why CSP isn't more widespread.

I tried adopting CSPs on all my sites to full Mozilla Observatory[0] standard. One is a Go based Heroku instance, where I used unrolled/secure[1], though there are a few different packages achieving this. The others are static Netlify deploys using Netlify CMS. For those, you have to include a headers file (in my case I am instructing Hugo to build the site with a .headers media file included, which Netlify parses).

Some observations:

\- It's a huge pain in the ass / trial and error process

\- The formatting for CSP rules was evidently made to be as insufferable as imaginable. All on the same line, with commas and semicolons being the only separators, no line-breaks, tabs or anything allowed. Seriously, wtf

\- When you think you've got it working, some other thing breaks in a weird, silent way

\- Debugging CSPs in Firefox is nearly impossible (as for certain in-line scripts, you will need to get SHA values to tell the CSP to let them through. Chrome provides the SHA in the console. Firefox bizarrely doesn't.)

\- Trying to integrate google recaptcha with CSP is hilariously complicated

\- You should try to host all fonts yourself, lest you need to enable google or fontawesome exceptions for font, CSS, script and svg, because apparently that's what you need just to get an FB icon on your page to work

\- Forget about React, or anything using inline-script or styles. Netlify CMS and the Netlify identity widget all require inline styles and scripts. Even generating SHA values for all of those, I could not get this stuff to work. In the end I gave up and disabled the CSP again

And this is for static sites using really simple tooling. I have yet to find a viable way to make this work.

edit (some additional notes):

\- Tools like this one[2] did not generate SHA values that were accepted by the CSP. I have tried a few different tools, checked all white spaces over and over. I just couldn't get it to work. Only Chrome returned the proper SHA value.

\- I tried fixing a hover state loading in improperly (it flickered on first hover). This wasn't related to the CSP, but because I had to try lots of different things, like load in an SVG sprite, or png sprite, try pre-loading, use some JS, etc. etc. I had to keep changing the CSP to work with this, too. So applying a CSP should only be done at the end of a project. At the same time, if anything breaks from one day to the next, your debugging will now include the CSP as well most likely.

\---

[0][https://observatory.mozilla.org/](https://observatory.mozilla.org/)

[1][https://github.com/unrolled/secure](https://github.com/unrolled/secure)

[2][https://passwordsgenerator.net/sha256-hash- generator/](https://passwordsgenerator.net/sha256-hash-generator/)

<comment><USER24> If something is so hard to use that nobody can be arsed to do it properly, it's generally a signal that the tool needs to be redesigned.

<comment><USER12> CSP could be better, but it's perfectly useful as it is. The problem is that too many people did things badly (using inline JavaScript), mixing up code and data. It's time-consuming to fix problems like that, but possible. Enabling CSP is easy... it's fixing your system so it works with it that takes time.

The CII Best Practices Badge uses restrictive CSP. You can tell that here: [https://securityheaders.com/?q=bestpractices.coreinfrastruct...](https://securityheaders.com/?q=bestpractices.coreinfrastructure.org&followRedirects=on)

</comment></comment></comment><comment><USER25> You can check your site's usage of most of these headers with [https://securityheaders.com](https://securityheaders.com). HSTS and more is checked by [https://www.ssllabs.com/ssltest/](https://www.ssllabs.com/ssltest/). Definitely make sure you understand what the headers do before changing them. Don't just copy/paste what you see here.

</comment><comment><USER26> This is how you can get the headers:

        curl -I -X GET \
            https://www.twilio.com/blog/a-http-headers-for-the-responsible-developer

<comment><USER27> "-X GET" is superfluous, as that is the default method.

<comment><USER28> Unless you use "-I", as in the example, in which case the default method is HEAD.

<comment><USER27> D'oh! I'll let the record stand as lesson on rash comments.

</comment></comment></comment></comment><comment><USER29> "Browser support for CSP is good these days, but unfortunately, not many sites are using it....I think we can do better to make the web a safer place"

Interestingly enough the blog this was posted on falls into the 94% not taking the effort to use CSP!

</comment><comment><USER30> CSP interacts in a surprising way (at least it was to me) with service workers.

[https://qubyte.codes/blog/content-security-policy-and- servic...](https://qubyte.codes/blog/content-security-policy-and-service- workers)

</comment><comment><USER31> I'm curious why/how XSS is a problem. Can someone describe a practical example of how this has been successfully abused? To me XSS allows a page to be distributed over many servers and that's more of a feature than a threat!

<comment><USER32> There are actually two different types of CSS, there's a _persistent_ version which loads any time any user loads a certain page, and there's a _reflected_ version which only shows up when a user clicks a mal-crafted link. The persistent version is the most dangerous, as it doesn't rely on the user being incredibly stupid. The reflected version is by far the most common, but since it requires the user to click on a malicious link, isn't usually the easiest to exploit.

But either way, they both allow an attacker to display information on a website, when the content didn't originate from that site.

An example of how this could be really bad, would be a script that deletes all of the content from the document body and replaces it with a login screen. Rather than actually logging you in, it submits the username and password you entered to a site the attacker has control over.

Another, less obvious method, would be a script that captures your session cookie and submits that to another site the attacker has control over. If you were logged in to the site, the attacker could use the session cookie to authenticate to the site as you without logging in.

<comment><USER31> Ok, in that case I don't see how headers solve the problem better than:

1) Don't click on bad URLs. (should be taught at kinder-garden by now)

2) Replace all input <> with <> etc.

I'm convinced scripts should not be able to read cookies for other domains?

Surely I'm missing something?

<comment><USER32> The Content-Security-Policy header prevents any new JavaScript from getting executed. Any inline scripts have to have a matching nonce, or SHA hash in the CSP header. With XSS, an attacker can insert content into the web page, but they can't modify the headers, so this effectively stops all XSS without some additional vulnerability being exploited.

</comment></comment></comment></comment><comment><USER33> > Did you ever wonder why you can't use local environments like my-site.dev > via HTTP with your browser anymore? This internal record is the reason – > .dev domains are automatically included in this list since it became a real > top-level domain in February 2019.

.dev hasn't been working locally for me for more than a year.

<comment><USER34> I use "foo.local" as a drop-in replacement, haven't had problems...

<comment><USER35> Any devices using mDNS might disagree.

<comment><USER34> Sure; tho I only said _I_ haven't had problems using ".local". In any case, I think your peer commenter who replied about use of '.test' "wins", though, given the RFC.

</comment></comment></comment></comment><comment><USER36> thx, my future headers cheat sheet.

</comment><comment><USER37> thanks :)</comment>


How to Join a Social Network in 1998 - <AUTHOR> http://www.ironicsans.com/2019/01/how_to_join_a_social_network_i.html <comment><USER2> I guess we're talking WWW or Web 2.0 or HTTP(S) or whatever (ie. bloat). Cu2 was a Dutch predecessor of Hyves which were both a very popular social network in The Netherlands before the existence of MySpace and Facebook. Eventually, "everyone" went to Facebook though.

Both were colorful (think: IRC on DALnet, or MySpace). It was awful.

The thing is, social networks existed before the term was ever coined. They were just called your "network". Getting to know people was called "networking". And most people get a job through their "network". It is nothing new. Something like Usenet or IRC or a MUD just as well fits.

<comment><USER3> Ah CU2, the memories. It's a while ago. One of the interesting things there is that it actually made people aware of technology. You had to learn some HTML (for horrible purposes though), you had to read urls.

Maybe it wasn't always for the good (eye bleeding color schemes for example). But I'm sure a lot of people learned the basics of HTMl through those types of websites.

<comment><USER4> Myspace served a similar purpose for later generations. It did for me, anyway.

There were still terrible color choices, and scrolling text, and flashing text, and glitter that followed your mouse cursor...

</comment></comment></comment><comment><USER5> Hm.. my "social network" was #coders on ircnet and efnet. NNTP, some ICQ contacts and a few forums.

</comment><comment><USER6> I (barely) recall chain letters being a very common thing back in those days. Probably the first form of "viral content" on the internet. Reading that email, it's easy to connect the dots of how sixdegrees probably had the idea of capturing that viral nature in a web app. Great example of clever and somewhat successful adaptation.

edit: internet != web

</comment><comment><USER7> In the UK, before Facebook we had Friends Reunited which many, many people were members of. It seemed to pass a number of hands after the original developers sold it - ITV bought it but it was beginning to lose members and interest, and they eventually sold it on to someone else. I reconnected with one of my old best friends from school who I'd not seen or spoken to in about 15 years so I certainly have it to thank for that (and we're still in touch).

There was another social media/networking site called Faceparty that was a little closer to Facebook and I used that for a short while before eventually going on to MySpace and then Facebook. And now I've dropped social media entirely - don't miss it in the slightest.

<comment><USER8> faceparty sounds like a fake social media site made up by a sitcom lol

<comment><USER7> It's a pretty awful name but it was around well before Facebook appeared or certainly became popular, I used it for a short while around 2002-2003. It wasn't a great place and I'm amazed it's still online.

</comment></comment></comment><comment><USER9> I spent most of my time in the mid 90s through early 2000s as an op in #HTML on Undernet. Good times. I actually got my first job through there.

<comment><USER10> I spent way too much time on undernet during the same period of time, mostly on #asp. I got my first and second programming jobs through friends I made there.

Wasn't there a site ran by one of the #html ops, htmlcenter or something like that?

<comment><USER9> There was! But I can't for the life of me remember who or what the site address was.

</comment></comment></comment><comment><USER11> I've been running/involved in mailing-lists, the non-SPAM kind, for decades.

Whatever the tech you use, _its the people._

</comment><comment><USER12> My network consisted of IRC, my huge list of ICQ contacts and a few web design or humor related local forums.

</comment><comment><USER13> I recall sixdegrees. I was invited to it by the same person who got me to sign up classmates.com and Friendster.

As far as websites with useful social networking functionality that resembles what we have today, I would say the PHPbb/vBulletin style forums were there early on. Sometime around 1999, I joined a forum on ezboard.com(1) which ended up turning into a long running discussion and meeting site. It was moved to a private server after ezboard transitioned in some way and deleted everyone's content circa 2003. It was the most prominent online resource in our artist community until it was replaced by Facebook and then Instagram.

(1) [https://en.m.wikipedia.org/wiki/Ezboard](https://en.m.wikipedia.org/wiki/Ezboard)

</comment><comment><USER14> In 1998 here in Sweden kids were joining the Skunk network, a very early social network. I guess it sort of exploded around that time so it's hard to backup a statement like "the first online social network".

<comment><USER15> We had StajlPleijs/Lunarstorm founded in 1996 [https://www.internetmuseum.se/tidslinjen/lunarstorm/](https://www.internetmuseum.se/tidslinjen/lunarstorm/)

<comment><USER16> With up to 600k memebers in a country of 9m at the time.

Lunarstorm was HUGE.

</comment></comment></comment><comment><USER17> I remember getting that email from a friend (who's still my friend) and thinking nah. Same with friendster which existed pre-MySpace. Folks comparing this to MOOs and IRC are missing that this was one of those first anglings to do what MySpace and Facebook eventually did. IRC and other online environs weren't built to gather users and use their information as raw material for advertisers. Sixdegrees was, it just failed earlier and faster than most.

</comment><comment><USER18> My 'social network' was LambdaMOO (well, earlier than 1998 I guess), and IRC.

</comment><comment><USER19> Fakeplace.com (the example domain in the join and add metadata section).

I think I just found the working title for my screenplay of a sequel to The Social Network.

</comment><comment><USER20> [https://de.m.wikipedia.org/wiki/MausNet](https://de.m.wikipedia.org/wiki/MausNet)

</comment><comment><USER21> Ah, it was a simpler time..</comment>


Ask HN: Best Time-Series Databases, open source and performant? - <AUTHOR> Please suggest some best open source players, which you have hands on and used to see best performance ! <comment><USER2> This is not enough info though. How would you like to access the data in the database?

I can think of few open source, performant databases that can store time series data:

\- PostgreSQL

\- Riak TS

\- InfluxDB

These are my favorites.

<comment><AUTHOR> Have you tried Dalmatein and TsDB ?</comment></comment>


How to Break YouTube (Copyright Claim Your Own Video) [video] - <AUTHOR> https://www.youtube.com/watch?v=ieErnZAN5Eo <comment><AUTHOR> When a system is broken, someone finally comes along and suggests hacking the system. If you don't have ten minutes to spare, here's the short version:

1\. If a third party claims makes a copyright claim on your video, they can elect to gain 100% of the ad revenue. Suggestion: claw back 50% (or more) by making copyright claim(s) against your own content.

2\. You may have videos that are not eligible for monetization (examples: just starting out on YouTube or reuploading content). Suggestion: make a copyright claim against your own video and it is automatically monetized.

Worth noting, a copyright claim is not the same as a copyright strike. Also, he may have stolen the idea from another YouTuber (which cannot be monetized) but I think he did a better job in the presentation. :)

<comment><USER2> Looks like making a claim is reserved for producers showing more than 4000 hours/year, AFAICT. The video was far from clear to me, though.

The solution appears to be filing through a company that can make such claims on your behalf.

<comment><AUTHOR> If you don't have access to directly make a claim, that solution is exactly what he walks you through. But if you're looking for more clarity, the original video [https://www.youtube.com/watch?v=Mz14Ul-r63w](https://www.youtube.com/watch?v=Mz14Ul-r63w) also discusses the use of a third party to make a claim through the Content ID system. Jump to about 3:30 into The Original Ace video.

Just don't stick around the outro on the original vid. It's _terrible_ , more proof-of-concept than anything.</comment></comment></comment>


Yet Another Padding Oracle in OpenSSL CBC Ciphersuites - <AUTHOR> https://blog.cloudflare.com/yet-another-padding-oracle-in-openssl-cbc-ciphersuites/ <comment><USER2> MAC-then-encrypt is a pet peeve of mine. It is so much safer to apply the message authenticator AFTER data has been encrypted, after which point it protects both the cipher text and the underlying plain text. Yes, I'm aware that there are reasons for going the other way, but having written plenty of secure communication suites over the years, I don't see any of them as especially compelling given the potential dangers.

</comment><comment><USER3> [https://filippo.io/CVE-2016-2107/#ycombinator.com](https://filippo.io/CVE-2016-2107/#ycombinator.com)

<comment><USER3> Also whitehouse.gov, verizon.com, yahoo.com, linkedin.com, instagram.com, netflix.com, hulu.com, washingtonpost.com....</comment></comment>